"We're concerned that voters' personal information could fall into the wrong hands and be used for illegal purposes," Jennifer Stoddart warned as she tabled a special audit of how private information is handled at four federal agencies.

Her study concluded that Elections Canada holds too much personal data about Canadians, including those not even old enough to vote. And with large numbers of people having access to the information, it's difficult to control its flow.

In one notorious instance in 2006, the RCMP reported finding lists of voters' names and addresses at the office of a Tamil Tiger group. The Tigers are considered a terrorist organization. Elections Canada said Thursday it is not aware of any other such flagrant instances.

Elections Canada spokeswoman Diane Benson said the agency takes the security of personal information seriously and has enhanced privacy training. "Elections Canada does have good systems in place," she said.

Stoddart agreed the agency is conscientious about information security. Nonetheless, Elections Canada's own study of four byelections held in September 2007, found that between four per cent and 12 per cent of poll documents and electoral lists couldn't be accounted for.

During March 2008 byelections, it found that one per cent of electoral documents were missing. And in a study of polling divisions around Toronto's Trinity Spadina riding in the 2006 general election, it found numerous voters lists, electronic records and registration certificates couldn't be located. Elections Canada redesigned its training and boosted security.

Perturbing to many Canadians, Stoddart added, is a provision of Canadian law that permits political parties access to voters' lists with names, addresses and a voter identifier number. Parties use the information to campaign. Elections Canada said it does not provide parties with information such as date of birth.

Political parties are not constrained by the Privacy Act, so the lists they obtain can end up in a variety of places.

The privacy commissioner said she routinely receives complaints from voters who are unaware that political parties possess their names and addresses.

"When you see this gap or this possibility at every election for political parties to get information, it does raise the broader question ... about how much personal information should political parties get without the consent of the citizens."

Stoddart is also concerned after Public Safety Minister Peter Van Loan said this week the Conservative government plans to introduce eavesdropping legislation that will help police tap Internet exchanges such as Facebook or Internet phone lines.

Stoddart said while she hasn't seen the legislation yet, the idea represents a "very serious step toward mass surveillance."

So far, "I've seen no compelling argument put forward for its justification," she said.